How I can to setup the server firewall to deny any ICMP traffic come only from host 1 while permitting the other.

host 1 is a switch Vlan =

when I do

Remote Ip = Wildecard Mask = the server deny all hosts.

  • Yes, that wildcard mask affects 256 addresses. You have eight address bits in the wildcard mask (2^8=256). but you seem to want zero wildcard mask bits to limit it to a single device (2^0=1). – Ron Maupin Nov 23 '20 at 21:52
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 16 '20 at 23:39

Remote Ip = Wildecard Mask = the server deny all hosts.

Yes, because the wildcard matches all hosts from through You need to use a wildcard of (no wildcard bits = direct match).

Any wildcard bit you use tells the TCAM to ignore mismatches on that bit. Accordingly a single wildcard bit matches two addresses:

  • matches and
  • matches and
  • matches and

and so on.

Two wildcard bits match four addresses, three bits match eight addresses, etc.

You can only specify ranges if they match binary patterns.

  • Sorry for stupid question, I'm still learning, but let's take the second example, if i set will the firewall ignore all IPs from to or only these 2 specific IPs? Logically what I'm thinking is that this is a range, but I want to be sure. – sticsk Dec 24 '20 at 0:32
  • 1
    With a wildcard of 32 = binary 0010 0000, the pattern 0000 0010 matches 0000 0010 and 0010 0010 = .2 and .34 - not a range. Note the difference to the CIDR notation, e.g. /24 = matching w.x.y.0 through x.x.y.255. – Zac67 Dec 24 '20 at 8:02
  • Very well, thank you very much for answering. – sticsk Dec 24 '20 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.